everyday is zero day, today is flash player
DESCRIPTION
My HITCON 2014 Presentation SlideTRANSCRIPT
1
By Lucas Leong
• NCTU Software Quality Lab
• Trend Micro
• Focus on…
• Document exploit
• Antivirus engine
• CTF
2
• A journey for a complete zero-day exploit nowadays
• Crash it
• How is the birth of a Flash Player zero-day exploit
• Exploit it
• How to take control of it
• Bypass it
• How many and how to overcome exploit mitigations
nowadays
3
4
• Part of my daily work is to review new CVE and
enhance antivirus engine.
• HTML, PDF, Office, Flash …
• Most of Flash Player CVE relate to ActionScript
• Flash Player’s regular expression CVE in 2014 H1
• CVE-2014-0498
• CVE-2014-0499
• CVE-2014-0502
5
• Easy to implement RE fuzzer
• RE syntax is less diverse
• Hard to implement RE engine
• RE semantic is complicated
• RE engine == RE compiler
• Flash player maintains a modified-PCRE
6
7
• List all PCRE syntax
• Fuzzer in Actionscript
8
while (true) {
valid_syntax_re = random_generate();
re = new RegExp(valid_syntax_re, “”);
“WMLIANG”.match(re);
}
9
10
11
• Generated a set of crashes ideally
• Figure out the root cause manually
12
• In PCRE compiler
13
function pcre_compile() {
int length;
// first-phase for estimating the length of compiled RE
compile_regex(NULL, &size);
re = malloc(size);
// second-phase for compiling RE actually
compile_regex(re, NULL);
}
• In PCRE compiler
14
function pcre_compile() {
int size;
compile_regex(NULL, &size); // return size = 0xA0 bytes
re = malloc(size);
compile_regex(re, NULL); // but overwrite > 0xA0 bytes
}
15
16
V V V V V V V V
V V V V V V V V
V V V V V V V V
V V V V V V V V
V V V V V V V V
V V V V V V V V
• Allocate Vector objects in memory
a Vector object with 0xA0 bytes
Vector length
17
V V Free V V V Free V
V V Free V V V Free V
V V Free V V V Free V
V V Free V V V Free V
V V Free V V V Free V
V V Free V V V Free V
• Free some of them
a Vector object with 0xA0 bytes
Vector length
18
V V Free V V V Free V
V V Free V V V Free V
V V Free V V V Free V
V V Free V V V Free V
V V Free V V V Free V
V V RE V V V Free V
• Allocate malicious RE object and trigger the overflow
a Vector object with 0xA0 bytes
Vector length
19
20
21
22
23
24
• If you ignore EMET and Browser sandbox…
1. Locate the base address of DLLs
2. Build ROP
3. Execute shellcode
4.
25
• Platform-dependent
• Easily detected (eg. EMET)
• Cost of time
• Continuous execution
26
27
28
29
Let’s change to calc.exe,
but read-only …
30
Let’s change to read-write
1. Prepare the arguments
2. Call Function2 -> VirtualProtect()
3. Change to “calc.exe”
4. Call Function1 -> CreateProcess()
5.
31
32
• Platform-dependent
• Easily detected (eg. EMET)
• Cost of time
• Continuous execution
33
34
36
[1] Haifei Li, "Smashing the Heap with Vector: Advanced
Exploitation Technique in Recent Flash Zero-day Attack"
